Vulnerability Description
Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in that cluster are disconnected. A recursion was introduced in the procedure of disconnecting idle connections that can lead to stack exhaustion and abnormal process termination when a cluster has a large number of idle connections. This infinite recursion causes Envoy to crash. Users are advised to upgrade.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Envoyproxy | Envoy | >= 1.20.0, < 1.20.2 |
Related Weaknesses (CWE)
References
- https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522PatchThird Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxfIssue TrackingThird Party Advisory
- https://github.com/envoyproxy/envoy/commit/4b6dd3b53cd5c6d4d4df378a2fc62c1707522PatchThird Party Advisory
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-9vp2-4cp7-vvxfIssue TrackingThird Party Advisory
FAQ
What is CVE-2022-23606?
CVE-2022-23606 is a vulnerability with a CVSS score of 4.4 (MEDIUM). Envoy is an open source edge and service proxy, designed for cloud-native applications. When a cluster is deleted via Cluster Discovery Service (CDS) all idle connections established to endpoints in t...
How severe is CVE-2022-23606?
CVE-2022-23606 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-23606?
Check the references section above for vendor advisories and patch information. Affected products include: Envoyproxy Envoy.